# Architectural decisions

Read the original decisions, their constraints and their recorded evidence.

The pages below render the Markdown files in `docs/adr` directly. The decision records are the source of truth; feature guides explain how to work within them.

Each record starts with a status line: the status, the date it was accepted and, where it applies, the record that amends or supersedes it. An accepted decision changes only through a new record or a dated clarification.

| ADR                                                              | Decision                                                                      | Status                                      |
| ---------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------------- |
| [0001](/docs/adr/0001-stored-file-keys-keep-the-user-s-filename) | Stored file keys keep the user's filename                                     | accepted · 2026-07-13                       |
| [0002](/docs/adr/0002-no-barrels-on-server-capable-modules)      | Server-capable modules have no barrel                                         | accepted · 2026-07-30                       |
| [0003](/docs/adr/0003-organizations-are-the-tenant)              | Organizations are the tenant                                                  | accepted · 2026-09-17                       |
| [0004](/docs/adr/0004-payments-providers)                        | Payments: one entitlement read model, three provider modules                  | accepted · 2026-10-12                       |
| [0005](/docs/adr/0005-effect-boundary)                           | Effect stays at the server edges                                              | accepted · 2026-10-12 · amended by 0010     |
| [0006](/docs/adr/0006-effect-persisted-queue)                    | Todo imports and the PersistedQueue gate                                      | accepted · 2026-10-13                       |
| [0007](/docs/adr/0007-ai-assistant-and-tool-catalog)             | AI assistant and one tool catalog                                             | accepted · 2026-10-14                       |
| [0008](/docs/adr/0008-documents-and-large-uploads)               | Documents and direct uploads                                                  | accepted · 2026-10-15                       |
| [0009](/docs/adr/0009-row-level-security)                        | Row-level security isolates Organizations                                     | accepted · 2026-10-16                       |
| [0010](/docs/adr/0010-procedures-run-one-effect-program)         | Procedures run one Effect program at their edge                               | accepted · 2026-10-17 · amends 0005         |
| [0011](/docs/adr/0011-backend-feature-shape)                     | Backend features have a fixed file shape                                      | accepted · 2026-10-17 · amended by 0013     |
| [0012](/docs/adr/0012-web-features-mirror-the-backend-shape)     | Web features mirror the backend shape                                         | accepted · 2026-10-17                       |
| [0013](/docs/adr/0013-mobile-features-mirror-the-backend-shape)  | Mobile features mirror the backend shape                                      | accepted · 2026-10-17 · amends 0011         |
| [0014](/docs/adr/0014-autofolio-on-the-template)                 | AutoFolio on the template                                                     | accepted · 2026-10-22                       |
| [0015](/docs/adr/0015-autofolio-data-model)                      | The AutoFolio data model                                                      | accepted · 2026-10-22                       |
| [0016](/docs/adr/0016-appearance-and-car-colour)                 | Appearance themes and car colour                                              | accepted · 2026-10-23 · amends DESIGN.md §2 |
| [0017](/docs/adr/0017-ai-model-registry-and-quotas)              | AI features: one model registry, a flag per feature, plan quotas              | accepted · 2026-10-23                       |
| [0018](/docs/adr/0018-copilot-generative-ui)                     | The copilot draws typed tool results as fixed cards, not OpenUI               | accepted · 2026-10-23                       |
| [0019](/docs/adr/0019-erasure-after-a-grace-period)              | Deleting an account waits 30 days; cars others use leave as History Transfers | accepted · 2026-10-23                       |